{"id":"MAL-2026-18358","summary":"Malicious code in @testsecuiitytestme/cache-helper (npm)","details":"@testsecuiitytestme/cache-helper is the only package of the npm account testsecuiitytestme. It was created on 2026-10-27 at 12:08 UTC with npm's staged-publish placeholder 0.0.0-stage, followed by 1.0.1 (12:28 UTC), 1.0.2 (15:33 UTC) and 1.0.3 (16:24 UTC); a 1.0.0 was removed before 14:21 UTC. It describes itself as \"Cache helper utilities\" and has no README, repository or source code. 1.0.3 was the latest version and still live at the time of this report.\n\nEach version runs a native addon at install time. 1.0.1 has postinstall: node -e \"try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}\". 1.0.2 and 1.0.3 depend on node-gyp-build and run it as postinstall, which loads the prebuilt addon shipped in prebuilds/linux-x64/node.napi.node or prebuilds/win32-x64/node.napi.node. 1.0.3 adds a binding.gyp with an empty sources list and an install script node-gyp rebuild, so the package looks like an ordinary native module; there is no C source in any version.\n\nThe addon (Linux ELF and Windows PE) is a loader. It checks for CI and sandbox environments (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID and others, plus SANDBOX), containers (/proc/1/cgroup: docker, containerd, kubepods, podman), a debugger (TracerPid), memory and CPU count, then reads the sibling file .napi_cache, writes it to a hidden temp file and runs it in a detached process.\n\n.napi_cache is JavaScript encoded with a single-byte XOR (0x96). It exits under CI, decodes a second layer (repeating 32-byte XOR, then brotli), locates the Bun runtime or downloads bun 1.2.18 from the official oven-sh/bun GitHub releases, writes the decoded program to the temp directory and runs it detached with Bun. This loader shape matches the second wave of the Shai-Hulud npm worm.\n\nThe Bun program is obfuscated (javascript-obfuscator string table). Its strings show credential collection for npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub and GHCR, AWS, GCP, Azure, HashiCorp Vault and Kubernetes, plus .ssh, .git-credentials, .env files, browser login databases, the macOS keychain, 1Password and Bitwarden. They also show propagation: npm publishing with provenance, PyPI and RubyGems publishing, GitHub workflow and composite-action injection, GitLab CI template changes, and writes to AI assistant configuration (.claude/settings.json hooks, .cursor rules, .mcp.json, copilot-instructions.md, CLAUDE.md). The exfiltration endpoints sit behind a further string-encoding layer that was not decoded. Analysis was static only; nothing was executed.\n\nTarball sha256:\n1.0.1: a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002\n1.0.2: 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113\n1.0.3: 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed\n\nFile sha256:\n1.0.2 prebuilds/linux-x64/node.napi.node: 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf\n1.0.2 prebuilds/win32-x64/node.napi.node: 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763\n1.0.2 .napi_cache: 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7\n1.0.3 prebuilds/linux-x64/node.napi.node: 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03\n1.0.3 prebuilds/win32-x64/node.napi.node: 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b\n1.0.3 .napi_cache: c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57","modified":"2026-10-28T09:30:16.540953324Z","published":"2026-10-27T16:30:00Z","affected":[{"package":{"name":"@testsecuiitytestme/cache-helper","ecosystem":"npm","purl":"pkg:npm/%40testsecuiitytestme/cache-helper"},"versions":["1.0.1","1.0.2","1.0.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@testsecuiitytestme/cache-helper/MAL-2026-18358.json"}}],"schema_version":"1.9.2","credits":[{"name":"r-bedekar","type":"ANALYST"}]}